Database/Control plane, storage & DevOps

Grafana Enterprise: SAML responses skip InResponseTo validation, allowing assertion replay

CVE-2026-12704Control plane, storage & DevOpscurated

Impact

Enabling IdP-initiated SAML login makes the SAML library skip InResponseTo validation on every response, including SP-initiated ones, which removes anti-replay protection across the board. An attacker holding a valid signed assertion for a user - recovered from a log, a proxy, browser history or a referrer - can replay it and obtain a session as that user, up to an admin account. Grafana in a GPU fleet holds the fleet telemetry dashboards and data source credentials, so an admin session there is worth more than it looks. Exposure is narrow: Enterprise only, off by default, and only instances with allow_idp_initiated enabled; Grafana OSS is not affected. Obtaining the assertion is the hard part, which is why Grafana scores it AC:H with user interaction.

Who can reach it

Remote attacker, unauthenticated to Grafana, who has already obtained a valid signed SAML assertion for the target user. Requires user interaction and only works where allow_idp_initiated is turned on.

What to do

Upgrade to the fixed Grafana Enterprise release named in the advisory for CVE-2026-12704. If no upgrade window is available, disable the allow_idp_initiated SAML setting - that restores InResponseTo validation immediately, at the cost of breaking IdP-initiated login for users who rely on the IdP dashboard tile. Either way the cost is a Grafana service restart; no GPU node maintenance.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-12704 https://grafana.com/security/security-advisories/cve-2026-12704

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.